Protecting Data Privacy from Side Channel Attacks in Mobile Cloud Computing Environments

1. Protecting Data Privacy from Side Channel Attacks in Mobile Cloud Computing Environments Dr. Weichao (Chao) Wang Department of Software and Information Systems UNC Charlotte weichaowang@uncc.edu

2. Security challenges of cloud computing • Cloud computing provides a lot of benefits to both end users and infrastructure providers: • Fast development and deployment • Reduction in resource consumption and maintenance overhead • US Air Force and IBM designed and demonstrated a secure cloud computing environment since 2010 • However, major security challenges emerge: • Break the isolation among multiple machines • Implicit information collection and aggregation from different sources to enable new applications

3. Our Simplified Scenario

4. Organization of the Presentation • Defending against side channel attacks among VMs • Memory de-duplication based attacks • Application-level defense • Hypervisor-level defense • Preserving data query privacy in mobile mashups • Threats to data privacy in mashups • Proxy based approach for server side mashups • App-level VM migration for client side mashups • Future Extensions

5. Defending against side channel attacks among VMs • Virtual machines belonging to different users are located in the same physical box; • While perfect isolation is expected, sharing of CPU and memory creates new vulnerabilities

6. Memory De-duplication: reduce VM footprint size • The owner of a VM farm tries to squeeze as many VM as possible into the same physical box • The memory de-duplication technique: • Store only one copy of the memory pages with identical contents; • Can reduce the memory footprint size of a VM by 70% • Used by major hypervisors such as VMWareESXi, XEN, and KSM

7. How does Memory De-duplication function? • A newly loaded page always gets its own memory • Hypervisor scans for memory pages that are identical during free clock cycles • If found, the hypervisor maintains a handler for each virtual memory page and they all point to a single physical copy • Copy-on-write: • Create your own copy before any “write” operations

8. Memory De-duplication

9. Vulnerability of Memory De-duplication • “Copy-on-write” introduces a tiny delay at the user side • If we can capture this delay, we learn the memory page content of another VM • Can be used for • Non-interactive OS fingerprinting • Data set or application software fingerprint • Is this the same as the cache sharing based key stealing [CCS’12]? No • No privileged switch or pre-knowledge of the location of the contents

10. Implementation of the attacks • Generation of the signature pages • Delay caused by a single write operation cannot be measured • Memory dump and cross-comparison • Delay measurement at the attacker’s VM • In a hypervisor (like VMWare), the APIC timer is virtualized to measure duration in milliseconds • Hardware based instructions make the APIC timer even more accurate • use the timeGetTime directive provided by masm32

11. Example: non-interactive OS fingerprint • OS fingerprinting is an essential step for many subsequent attacks • Traditional attacks send out tens of TCP/IP packets • Can be detected by network/host based IDS • Non-interactive OS fingerprinting through the memory de-duplication technique • How about Address Space Load Randomization • Move the memory in chunk of 64KB • Each memory page is 4KB

12. Size of signature pages

13. Experimental results with different overhead • Consider CPU and Memory demands at different levels: • Low: left idle • Medium: • CPU – running encryption algorithms • Memory – QA+Win32 memory test • High: • Prime95 stress test

14. OS Fingerprinting Low CPU/Memory Demand

15. Medium CPU + Memory Medium CPU Demand Medium Memory Demand High CPU + Memory

16. Example 2: Data set fingerprint We have chosen five biological data sets available from the European Institute of Tele-Surgery - Institut de Recherche Contre les Cancers de L’Appareil Digestif

17. Data Set Attack Experiment Result

18. Defense Methods Physical isolation or totally disable memory de-duplication (negative impacts on system performance and not attractive to cloud owner) User level defense: obfuscation based defense Hypervisor level defense: Fine-grained de-duplication control

19. Obfuscation based defense • Intentionally load signature pages of other OS or software packages into memory • Pros: • Full control by the end user • Fast and Easy to Implement • Nearly zero CPU usage • Cons: • Uses memory allotted to guest • User’s responsible for deployment, and updating

20. Guest Defense Concept Windows 7 Windows XP

21. VM Defense Experiment Results (low CPU usage)

22. VM Defense Experiment Results (high CPU usage)

23. Impacts on VM Performance SQL User SQL User SQL User SQL User SQL Server 2008 R2 Windows 7 VMwareESXi • VMwareESXiHypervisor • Target VM, Windows 7 • SQL Server 2008 R2, with AdventureWorks sample database from Microsoft. • 10 virtual SQL clients to read and write to database. • Ran Defense Program at 2 second interval

24. Impacts on VM Performance

25. Hypervisor Level Defense: under development • Implement in XEN • Fine-grained control over de-duplication configuration • Pros: • Waste very little memory • More efficient than user level defense • Cons: • Difficult to implement, requires modifying hypervisor

26. Hypervisor Level Defense: under development Support real time updates to de-duplication configurations Active or passive scan of memory pages Use scientific application to test our approaches

27. The next steps Side channel attacks pose serious challenges to security of virtualization and cloud computing environments; The implemented approaches will be tested in both lab-based environment and real cloud computing environment; In additional to the known memory and cache based attacks, explore new fields to study the relationship b/w sharing of resources and vulnerabilities;

28. Conclusion Cloud computing creates a brand new territory for us to provide efficient services to end users; Security attacks must be carefully addressed to protect system security and data privacy; Both application level and system level approaches need to be explored and assessed;